media: allegro: Fix use after free on error
authorDan Carpenter <dan.carpenter@oracle.com>
Mon, 14 Dec 2020 11:54:47 +0000 (12:54 +0100)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Thu, 4 Mar 2021 10:37:37 +0000 (11:37 +0100)
commite559765186ac6da502bdbe23490a7eda2639de6e
tree2c3a07c661a4f27afe6dc301fbef39ae53dd0de4
parent5ea0601513a70416814297fbed93e7b749991c46
media: allegro: Fix use after free on error

[ Upstream commit ce814ad4bb52bfc7c0472e6da0aa742ab88f4361 ]

The "channel" is added to the "dev->channels" but then if
v4l2_m2m_ctx_init() fails then we free "channel" but it's still on the
list so it could lead to a use after free.  Let's not add it to the
list until after v4l2_m2m_ctx_init() succeeds.

Fixes: cc62c74749a3 ("media: allegro: add missed checks in allegro_open()")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Michael Tretter <m.tretter@pengutronix.de>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
drivers/staging/media/allegro-dvt/allegro-core.c